CN106211163B - Method and apparatus for secure networking - Google Patents

Abstract

The invention relates to a method and a device for secure networking. The method comprises the following steps: acquiring factory mac address information of a wifi module of equipment, and writing the factory mac address information into a preset security module, wherein the security module is a module requiring authority authentication when information is written; when a connectable wifi network is detected, reading a factory mac address stored in the security module, and acquiring a current mac address of the wifi module; and comparing the current mac address with the outgoing mac address, and judging whether the equipment is unsafe to access the wifi network according to the comparison result. The method and the device can reduce the risk of information leakage caused by equipment networking.

Description

Method and apparatus for secure networking

technical field

The present invention relates to the technical field of intelligent terminals, in particular to a method and a device for secure networking of an intelligent terminal.

Background technique

With the rise of smart devices such as smartphones, more and more smart devices are used by users. Wifi technology has been relied on since the rise and has become more and more widely used. With the widespread use of wifi, it also leads to some security issues such as information leakage. Taking a mobile phone as an example, since the wifi modules on different mobile phones are distinguished by different mac addresses, if the mac addresses are the same, for the network, it is considered to be the same mobile phone. Because the mac address of the wifi module of the mobile phone can be modified by some technical means, it leaves a security risk, especially in the network environment in public places, which brings a great deal of hijacking to the user's private information of the connected mobile phone. risks of.

SUMMARY OF THE INVENTION

Based on this, the embodiments of the present invention provide a method and apparatus for secure networking, which can reduce the risk of information leakage caused by device networking.

One aspect of the present invention provides a method for secure networking, comprising:

Obtain the factory mac address information of the device wifi module, and write the factory mac address information into a preset security module, where the security module is a module that requires authority authentication when writing information;

Detecting a connectable wifi network, reading the factory mac address stored in the security module, and obtaining the current mac address of the wifi module;

Compare the current mac address with the factory mac address, and judge whether the device is insecure to access the wifi network according to the comparison result.

Another aspect of the present invention provides a device for secure networking, comprising:

The writing management module is used to obtain the factory mac address information of the device wifi module, and write the factory mac address information into a preset security module, and the security module is a module that requires authority authentication when writing information;

The reading management module is used to detect that there is a connectable wifi network, read the factory mac address stored in the security module, and obtain the current mac address of the wifi module;

The detection module is used to compare the current mac address with the factory mac address, and judge whether the device is unsafe to access the wifi network according to the comparison result.

In the above technical solution, by writing the factory mac address information of the device wifi module into the preset security module, since the security module requires authority authentication when writing information, the mac address information written therein is not easily tampered with; The current mac address of the device wifi module and the factory mac address stored in the security module can determine whether the current mac address of the device wifi module has been tampered with; Reduce the risk of information leakage caused by the device connecting to the wifi network.

Description of drawings

FIG. 1 is a schematic flowchart of a method for secure networking according to an embodiment;

FIG. 2 is a schematic flowchart of a method for secure networking according to another embodiment;

FIG. 3 is a schematic structural diagram of a secure networking device according to an embodiment.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention, but not to limit the present invention.

FIG. 1 is a schematic flowchart of a method for secure networking according to an embodiment; as shown in FIG. 1 , the method for secure networking in this embodiment includes steps:

S11, obtaining the factory mac address information of the device wifi module, and writing the factory mac address information into a preset security module, where the security module is a module that requires authority authentication when writing information;

When the device leaves the factory, the wifi modules of different devices are assigned different mac addresses, so that the network can uniquely identify the wifi module of the device and perform data connection. Taking a mobile phone as an example, since the wifi modules on different mobile phones are distinguished by different mac addresses, if the mac addresses are the same, for the network, it is considered to be the same mobile phone.

Preferably, if the device is configured with an NFC (Near Field Communication, near field communication) module, an NFC secure element (secure element, SE for short) of the device can be used as the security module. The SE of NFC can be considered as a memory card, which can be used to store some important data information, and modifying the data in the SE requires authorization authentication, so it is less likely to be illegally tampered with.

Preferably, in this embodiment of the present invention, an application program for detecting network security may be installed in the device in advance, so that the factory mac address information of the device wifi module can be written into the preset security module through the application program.

S12, detecting that there is a connectable wifi network, reading the factory mac address stored in the security module, and obtaining the current mac address of the wifi module;

As another preferred embodiment, this step may also be: reading the factory mac address stored in the security module and the current mac address of the wifi module according to a set time period.

Preferably, in order to improve efficiency, it may be set that permission verification is performed only when the application program runs for the first time, so as to determine whether the application program has the read and write permission of the security module. If it is not running for the first time, the factory mac address can be directly read from the security module. In fact, when the application is run for the first time, the purpose is to write the factory mac address information of the device wifi module into the security module, so as another preferred implementation, it can also be: when writing to the security module Permission verification needs to be performed when information is required, and when information needs to be read from the security module, permission verification may not be performed, so as to improve the efficiency of reading information.

S13, compare the current mac address with the factory mac address, and determine whether it is insecure for the device to access the wifi network according to the comparison result.

In the embodiment of the present invention, if the comparison result is the same, it indicates that the current mac address of the wifi module has not been illegally tampered with, and it can be determined that the device is safe to access the wifi network, so the wifi module of the device can be accessed normally connectable network. If the comparison result is inconsistent, it indicates that the current mac address of the wifi module may be illegally tampered with, so it is determined that the device is unsafe to access the wifi network, and the wifi module of the device is prohibited from accessing the network. At this time, the device will not be able to connect to the Internet through its wifi module, so as to ensure that the user information stored in the device is leaked. The user needs to deliver the device to the corresponding personnel for detection and restoration of settings, so that the network can be connected normally.

In the method for secure networking according to the embodiment of the present invention, the factory mac address information of the device wifi module is written into the preset security module. Since the security module requires authority authentication when writing information, it is not easy to write the mac address information therein. tampered; then by detecting the current mac address of the device wifi module and the factory mac address stored in the security module, it can be determined whether the current mac address of the device wifi module has been tampered with; and then determine whether the device accesses the wifi network exists Security risk, thereby reducing the risk of information leakage caused by the device accessing the wifi network.

2 is a schematic flowchart of a method for secure networking according to another embodiment; taking a device configured with an NFC module as an example, the method for secure networking of the present invention is further described; the NFC secure element of the device is the security module. As shown in FIG. 2 , the method for secure networking in this embodiment includes the steps:

S21, an application program for detecting network security is installed in the device in advance, so that the factory mac address information of the device wifi module is written into the NFC secure element through the application program;

S22, detect whether the application program is running for the first time, if so, execute the next step, otherwise, execute the step;

S23, perform authority verification to determine whether the application program has the read and write authority of the NFC secure element, and if the authority verification passes, execute the next step; otherwise, prohibit the application program from using the factory mac address information of the device wifi module Write to the NFC Secure Element.

In this embodiment, the authority verification method may be performed by connecting to a corresponding server, or by a password.

S24, initialize the application program, and write the factory mac address information of the device wifi module into the NFC secure element.

S25, it is detected that there is a connectable wifi network, the factory mac address stored in the NFC secure element is read, and the current mac address of the wifi module is obtained.

S26, compare the current mac address with the factory mac address to see if the two are consistent, and if so, it is determined that the device is connected to the wifi network safely and is connected to the network normally; otherwise, it is determined that the device is unsafe to access the wifi network, prohibiting The device wifi module is networked.

In the method for secure networking according to the embodiment of the present invention, the factory mac address information of the device wifi module is written into the NFC secure element of the device, because the mac address information written into the NFC secure element is not easily tampered; The current mac address and the factory mac address stored in the NFC secure element can determine whether the mac address of the device wifi module has been tampered with. Networking, thereby reducing the risk of leakage of user information in the device.

It should be noted that, for the convenience of description, the foregoing method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the described action sequence, because Certain steps may be performed in other orders or simultaneously in accordance with the present invention.

Based on the same idea as the method for secure networking in the above embodiments, the present invention also provides a device for secure networking, which can be used to execute the above method for secure networking. For convenience of description, in the schematic structural diagram of the embodiment of the device for secure networking, only the part related to the embodiment of the present invention is shown. Those skilled in the art can understand that the illustrated structure does not constitute a limitation on the device, and may include a comparison diagram. more or fewer components are shown, or some components are combined, or a different arrangement of components.

FIG. 3 is a schematic structural diagram of a device for secure networking according to an embodiment of the present invention; as shown in FIG. 3 , the device for secure networking in this embodiment includes: a writing management module 310 , a reading management module 320 and a detection module 330 , each module is detailed as follows:

The writing management module 310 is used to obtain the factory mac address information of the device wifi module, and write the factory mac address information into a preset security module, and the security module is a module that requires authority authentication when writing information ;

When the device leaves the factory, the wifi modules of different devices are assigned different mac addresses, so that the network can uniquely identify the wifi module of the device and perform data connection. Taking a mobile phone as an example, since the wifi modules on different mobile phones are distinguished by different mac addresses, if the mac addresses are the same, for the network, it is considered to be the same mobile phone.

The read management module 320 is configured to detect a connectable wifi network, read the factory mac address stored in the security module, and obtain the current mac address of the wifi module;

The detection module 330 is configured to compare the current mac address with the factory mac address, and judge whether the device is unsafe to access the wifi network according to the comparison result.

Preferably, the detection module 330 can be specifically configured to compare the current mac address with the factory mac address, and if the two are inconsistent, it is determined that the device is unsafe to access the wifi network, and the wifi module of the device is prohibited from being connected to the Internet; If the two are consistent, it is determined that it is safe for the device to access the Wi-Fi network, and the Wi-Fi module of the device is allowed to access the Wi-Fi network normally.

As a preferred embodiment, the device for secure networking may further include a verification module (not shown in the figure) for performing authority verification to determine whether the security module has read and write authority. Correspondingly, the writing management module 310 is further configured to prohibit writing the factory mac address information of the device wifi module into the security module if the authority verification fails.

Preferably, the security module in this embodiment refers to the NFC security element of the device. Preferably, if the device is configured with an NFC module, the NFC secure element of the device can be used as the security module. The SE of NFC can be considered as a memory card, which can be used to store some important data information, and modifying the data in the SE requires authorization authentication, so it is less likely to be illegally tampered with.

In the secure networking device according to the embodiment of the present invention, the factory mac address information of the device wifi module is written into the preset security module. Since authority authentication is required when writing information to the security module, the mac address information is written into the security module. It is not easy to be tampered with; and then by detecting the current mac address of the device wifi module and the mac address stored in the security module, it can be determined whether the mac address of the device wifi module has been tampered with, and if it has been tampered, it can be determined that the There is a security risk when a device is connected to a Wi-Fi network, which can effectively reduce the risk of information leakage caused by the device's access to the Wi-Fi network.

It should be noted that, in the implementation of the secure networking device in the above example, the information exchange and execution process among the modules/units are based on the same concept as the foregoing method embodiments of the present invention, and the technical effects brought about by them are based on the same concept. The same as the foregoing method embodiments of the present invention, the specific content can be referred to the descriptions in the method embodiments of the present invention, and details are not repeated here.

In addition, in the implementation of the secure networking device in the above example, the logical division of each functional module is only an example, and in practical applications, the above-mentioned configuration may be required according to needs, for example, for the convenience of the configuration requirements of the corresponding hardware or the realization of the software. The function distribution is completed by different function modules, that is, the internal structure of the secure networked device is divided into different function modules, so as to complete all or part of the functions described above. Each function module can be realized in the form of hardware or in the form of software function modules.

Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium as a Standalone product for sale or use. When the program is executed, all or part of the steps in the foregoing method embodiments can be performed. The storage medium may be a magnetic disk, an optical disk, a read-only memory (Read-Only Memory, ROM), or a random access memory (Random Access Memory, RAM) or the like.

In the above-mentioned embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference may be made to the relevant descriptions of other embodiments.

The above-mentioned embodiments only represent several embodiments of the present invention, and should not be construed as limiting the patent scope of the present invention. It should be pointed out that for those of ordinary skill in the art, without departing from the concept of the present invention, several modifications and improvements can also be made, which all belong to the protection scope of the present invention. Therefore, the protection scope of the patent of the present invention shall be subject to the appended claims.

Claims (10)

1. A method for secure networking, comprising: Obtain the factory mac address of the device wifi module, and write the factory mac address into a preset security module, where the security module is a module that requires authority authentication when writing information; Detecting a connectable wifi network, reading the factory mac address stored in the security module, and obtaining the current mac address of the wifi module; Compare the current mac address with the factory mac address, and judge whether the device is insecure to access the wifi network according to the comparison result. 2. The method for secure networking according to claim 1, wherein the step of judging whether the device is unsafe to access the wifi network according to the comparison result comprises: If the two are inconsistent, it is determined that it is not safe for the device to access the wifi network, and the wifi module of the device is prohibited from being connected to the Internet. 3. The method for secure networking according to claim 1, wherein the step of obtaining the factory mac address information of the device wifi module, and writing the factory mac address information into the preset security module further comprises: Preset an application program for detecting network security, so as to write the factory mac address information of the device wifi module into the preset security module through the application program; And, performing permission verification to determine whether the application program has the read and write permission of the security module. 4. The method for secure networking according to claim 3, wherein the step of performing authority verification to determine whether the application program has the read and write authority of the security module comprises: Detect whether the application program is running for the first time; if so, perform permission verification to determine whether the application program has the read and write permission of the security module. 5. The method for secure networking according to claim 3 or 4, wherein the step of performing authority verification to judge whether the application program has the read and write authority of the security module comprises: If a request for writing information to the security module is detected, permission verification is performed to determine whether the application program has the read and write permission of the security module. 6. The method for secure networking according to claim 3 or 4, characterized in that, further comprising: If the permission check fails, the application is prohibited from writing the factory mac address information of the device wifi module into the security module. 7. The method for secure networking according to any one of claims 1-4, wherein the security module is an NFC secure element of the device. 8. A device for secure networking, comprising: The writing management module is used to obtain the factory mac address of the device wifi module, and write the factory mac address into a preset security module, where the security module is a module that requires authority authentication when writing information; The reading management module is used to detect that there is a connectable wifi network, read the factory mac address stored in the security module, and obtain the current mac address of the wifi module; The detection module is used to compare the current mac address with the factory mac address, and judge whether the device is unsafe to access the wifi network according to the comparison result. 9 . The device for secure networking according to claim 8 , wherein the detection module is used to compare the current mac address with the factory mac address, and if the two are inconsistent, it is determined that the device is connected to wifi 9 . The network is not secure, and the wifi module of the device is prohibited from being connected to the Internet. 10. The device for secure networking according to claim 8, further comprising: a verification module, used to perform authority verification to determine whether the security module has read and write authority; The writing management module is further configured to prohibit writing the factory mac address information of the device wifi module into the security module if the authority verification fails.